2fa

npm adds staged publishing (GA) and new install-time allow flags, enforcing explicit approvals and explicit source allowlists, with versioned requirements and a future default change for git sources.

A critical essay contrasting a retro Casio watch with the modern, always-updating Apple ecosystem to argue that consumer tech creates perpetual maintenance and labor, with tangible examples of device debt and digital overwhelm.

Two malicious Axios releases were briefly published on npm due to a compromised maintainer account, introducing a remote-access trojan via plain-crypto-js; remediation focuses on OIDC-based publishing, immutable releases, CI publishing, and credential hygiene.